Dashboards & Visualizations

Why am I not able to save search in dashboard because of $ sign in search?

shaileshmali
Path Finder

Not able to save search in dashboard because of $ sign in search query.

match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")
0 Karma

micahkemp
Champion

Dashboards use $ to denote fields requiring input, such as $earliest, $latest, etc. It's probably failing to correctly parse that.

Try escaping the dollar signs in your search by doubling them up:

     match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
     match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"POST"), "TASK2",
     match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
     match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"GET"), "TASK4",
     match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")

niketnilay
Legend

Agree to @micahkemp's point, due to two $ signs in the same pipe, it is making Splunk search to treat the same as token in a dashboard. Escaping the $ sign with $$ should work for you.

Here is another option for you by breaking the case statement in two parts with a run anywhere example:

| makeresults
| eval RelativeURI="/identity/enhanced-authentication/tasks/*"
| eval HttpMethod="GET"
| eval test=case(
 match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
 match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
 match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3")
| eval test=case(match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
 match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5",
 true(),test)
| table RelativeURI HttpMethod test
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!